webfactory/icu-translation-bundle

Repo bus factorcaution

All recent commits came from one contributor, giving the repository a concentrated short-term bus factor. Organization backing partly compensates because maintenance can be handed off within the organization.

Repo commit activitycaution

The repository had 1 commit in the last 3 months, so there is recent activity, but the volume is light. This is a modest maintenance-capacity concern rather than evidence of abandonment.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected. The missing scanner is a hygiene gap, not evidence that the package is unsafe or unmaintained.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations unclear. This lowers transparency somewhat, although it is not a direct maintenance failure.

Workflow auditcaution

Both workflows were analyzed cleanly with no untrusted checkouts, script injection, high-severity findings, or broad top-level writes. However, all 5 action references are unpinned, which leaves avoidable build-integrity risk.